AI Briefing
KOSign in

Glow Labs: In 98% of Cases, Agents Source Deprecated MCP Server Names from Training Data

·2026.11.07 02:06

Key point

Glow Labs reports that in 98% of sessions where an agent configured a deprecated MCP server, the package name originated from the model's training data rather than user input.

Details

  • Glow Labs research indicates that in 98% of sessions where an agent set up a deprecated MCP server, the package name was sourced from the model's training data, not the user.
  • The archived repository for these servers states that no security updates or bug fixes will be provided.
  • Recommended verification commands include claude mcp list, codex mcp list, or checking ~/.cursor/mcp.json and running npm view <package> deprecated for any u/modelcontextprotocol/server-* entries.
  • Mitigation steps involve swapping in the service's own server, removing the old entry, reviewing any npx -y lines before acceptance, and denying access via mcp__<server> under permissions.deny in Claude Code if removal is not yet possible.
securitymcpcoding-agentsglow-labsdeprecated-packages
Read originalShare on Threads

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.

Related

Hacker NewsStream Vessel implements per-user MCP redirect allowlists to prevent OAuth phishingStripe EngineeringStripe enables AI agents to analyze business data via MCP and new APIsHacker NewsZalando Incubator Opens agentic-identity-broker for OAuth2 Delegation in AI AgentsWoowa BrothersWoowahan Brothers Establishes LLM and Agent Governance Framework with AI Gateway and AI StudioGeekNewsAnthropic releases cc-plugin-privacy to block Claude Code from sending user emails in User-Agent headersCloudflare BlogCloudflare Launches Trusted Agent Delegation Coalition and New Agent Visibility Tools